<html>
<head><meta charset="utf-8"><title>stacked borrows violation in slice iterators · t-lang/wg-unsafe-code-guidelines · Zulip Chat Archive</title></head>
<h2>Stream: <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/index.html">t-lang/wg-unsafe-code-guidelines</a></h2>
<h3>Topic: <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked.20borrows.20violation.20in.20slice.20iterators.html">stacked borrows violation in slice iterators</a></h3>

<hr>

<base href="https://rust-lang.zulipchat.com">

<head><link href="https://rust-lang.github.io/zulip_archive/style.css" rel="stylesheet"></head>

<a name="136703807"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked%20borrows%20violation%20in%20slice%20iterators/near/136703807" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked.20borrows.20violation.20in.20slice.20iterators.html#136703807">(Oct 29 2018 at 12:57)</a>:</h4>
<p>Finally I found a stacked borrows violation :D was about time. <code>iter_mut</code> for slices is UB according to my model.</p>



<a name="136703833"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked%20borrows%20violation%20in%20slice%20iterators/near/136703833" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked.20borrows.20violation.20in.20slice.20iterators.html#136703833">(Oct 29 2018 at 12:58)</a>:</h4>
<p>concretely, when <code>len</code> is called on <a href="https://github.com/rust-lang/rust/blob/4e88b7363b7858960ccfd87326ece9d00bf4d973/src/libcore/slice/mod.rs#L579" target="_blank" title="https://github.com/rust-lang/rust/blob/4e88b7363b7858960ccfd87326ece9d00bf4d973/src/libcore/slice/mod.rs#L579">https://github.com/rust-lang/rust/blob/4e88b7363b7858960ccfd87326ece9d00bf4d973/src/libcore/slice/mod.rs#L579</a>, that activates <code>self</code>, which -- being a unique reference -- invalidates the previously created raw <code>ptr</code></p>



<a name="136703883"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked%20borrows%20violation%20in%20slice%20iterators/near/136703883" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked.20borrows.20violation.20in.20slice.20iterators.html#136703883">(Oct 29 2018 at 12:58)</a>:</h4>
<p>(please don't <code>git blame</code> that code or it'll say that I wrote it^^ but in my defense, the previous code had the same problem)</p>



<a name="136704037"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked%20borrows%20violation%20in%20slice%20iterators/near/136704037" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked.20borrows.20violation.20in.20slice.20iterators.html#136704037">(Oct 29 2018 at 13:01)</a>:</h4>
<p>we <em>could</em> make this legal by saying that a borrow from which you reborrow just has to be reactivatable, but doesnt get reactivated</p>



<a name="136704219"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked%20borrows%20violation%20in%20slice%20iterators/near/136704219" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked.20borrows.20violation.20in.20slice.20iterators.html#136704219">(Oct 29 2018 at 13:05)</a>:</h4>
<p>I like this because it replaces a special case during reborrowing.</p>



<a name="136704882"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked%20borrows%20violation%20in%20slice%20iterators/near/136704882" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> kennytm <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked.20borrows.20violation.20in.20slice.20iterators.html#136704882">(Oct 29 2018 at 13:17)</a>:</h4>
<p>it is really a violation? the <code>self</code> here is a DST <code>&amp;mut [T]</code> which in memory is a <code>(*mut T, usize)</code> pair, and calling <code>len()</code> shouldn't really touch the data pointer part at all</p>



<a name="136705920"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked%20borrows%20violation%20in%20slice%20iterators/near/136705920" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked.20borrows.20violation.20in.20slice.20iterators.html#136705920">(Oct 29 2018 at 13:34)</a>:</h4>
<p><span class="user-mention" data-user-id="125254">@kennytm</span> fat references are considered a primitive</p>



<a name="136705933"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked%20borrows%20violation%20in%20slice%20iterators/near/136705933" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked.20borrows.20violation.20in.20slice.20iterators.html#136705933">(Oct 29 2018 at 13:35)</a>:</h4>
<p>I think it would be strange if <code>&amp;[T; 3]</code> was properly tracked but <code>&amp;[T]</code> was not</p>



<a name="136706400"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked%20borrows%20violation%20in%20slice%20iterators/near/136706400" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked.20borrows.20violation.20in.20slice.20iterators.html#136706400">(Oct 29 2018 at 13:42)</a>:</h4>
<p>so when <code>&amp;mut [T]</code> is coerced to <code>&amp;[T]</code>, that's a "use" of the src reference, and the destination of that reference (the place it denotes) is the entire slice</p>



<a name="136712449"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked%20borrows%20violation%20in%20slice%20iterators/near/136712449" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked.20borrows.20violation.20in.20slice.20iterators.html#136712449">(Oct 29 2018 at 15:17)</a>:</h4>
<p>with this, the following is now allowed (used to be a compile-fail test):</p>
<div class="codehilite"><pre><span></span><span class="k">fn</span> <span class="nf">test</span><span class="p">(</span><span class="n">r</span>: <span class="kp">&amp;</span><span class="nc">mut</span><span class="w"> </span><span class="n">RefCell</span><span class="o">&lt;</span><span class="kt">i32</span><span class="o">&gt;</span><span class="p">)</span><span class="w"> </span><span class="p">{</span><span class="w"></span>
<span class="w">    </span><span class="kd">let</span><span class="w"> </span><span class="n">x</span><span class="w"> </span><span class="o">=</span><span class="w"> </span><span class="o">&amp;*</span><span class="n">r</span><span class="p">;</span><span class="w"> </span><span class="c1">// not freezing because interior mutability</span>
<span class="w">    </span><span class="kd">let</span><span class="w"> </span><span class="k">mut</span><span class="w"> </span><span class="n">x_ref</span><span class="w"> </span><span class="o">=</span><span class="w"> </span><span class="n">x</span><span class="p">.</span><span class="n">borrow_mut</span><span class="p">();</span><span class="w"></span>
<span class="w">    </span><span class="kd">let</span><span class="w"> </span><span class="n">x_inner</span><span class="w"> </span>: <span class="kp">&amp;</span><span class="nc">mut</span><span class="w"> </span><span class="kt">i32</span><span class="w"> </span><span class="o">=</span><span class="w"> </span><span class="o">&amp;</span><span class="k">mut</span><span class="w"> </span><span class="o">*</span><span class="n">x_ref</span><span class="p">;</span><span class="w"> </span><span class="c1">// Uniq reference</span>
<span class="w">    </span><span class="kd">let</span><span class="w"> </span><span class="n">x_evil</span><span class="w"> </span><span class="o">=</span><span class="w"> </span><span class="n">x_inner</span><span class="w"> </span><span class="k">as</span><span class="w"> </span><span class="o">*</span><span class="k">mut</span><span class="w"> </span><span class="n">_</span><span class="p">;</span><span class="w"></span>
<span class="w">    </span><span class="p">{</span><span class="w"></span>
<span class="w">        </span><span class="kd">let</span><span class="w"> </span><span class="n">x_inner_shr</span><span class="w"> </span><span class="o">=</span><span class="w"> </span><span class="o">&amp;*</span><span class="n">x_inner</span><span class="p">;</span><span class="w"> </span><span class="c1">// frozen</span>
<span class="w">        </span><span class="kd">let</span><span class="w"> </span><span class="n">y</span><span class="w"> </span><span class="o">=</span><span class="w"> </span><span class="o">&amp;*</span><span class="n">r</span><span class="p">;</span><span class="w"> </span><span class="c1">// outer ref, not freezing</span>
<span class="w">        </span><span class="kd">let</span><span class="w"> </span><span class="n">x_inner_shr</span><span class="w"> </span><span class="o">=</span><span class="w"> </span><span class="o">&amp;*</span><span class="n">x_inner</span><span class="p">;</span><span class="w"> </span><span class="c1">// freezing again</span>
<span class="w">    </span><span class="p">}</span><span class="w"></span>
<span class="w">    </span><span class="c1">// Our old raw should be dead by now</span>
<span class="w">    </span><span class="k">unsafe</span><span class="w"> </span><span class="p">{</span><span class="w"> </span><span class="o">*</span><span class="n">x_evil</span><span class="w"> </span><span class="o">=</span><span class="w"> </span><span class="mi">0</span><span class="p">;</span><span class="w"> </span><span class="p">}</span><span class="w"> </span><span class="c1">// this falls back to some Raw higher up the stack</span>
<span class="w">    </span><span class="o">*</span><span class="n">x_inner</span><span class="w"> </span><span class="o">=</span><span class="w"> </span><span class="mi">12</span><span class="p">;</span><span class="w"> </span><span class="c1">//~ ERROR Mut reference with non-reactivatable tag</span>
<span class="p">}</span><span class="w"></span>

<span class="k">fn</span> <span class="nf">main</span><span class="p">()</span><span class="w"> </span><span class="p">{</span><span class="w"></span>
<span class="w">    </span><span class="n">test</span><span class="p">(</span><span class="o">&amp;</span><span class="k">mut</span><span class="w"> </span><span class="n">RefCell</span>::<span class="n">new</span><span class="p">(</span><span class="mi">0</span><span class="p">));</span><span class="w"></span>
<span class="p">}</span><span class="w"></span>
</pre></div>



<a name="136712471"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked%20borrows%20violation%20in%20slice%20iterators/near/136712471" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked.20borrows.20violation.20in.20slice.20iterators.html#136712471">(Oct 29 2018 at 15:17)</a>:</h4>
<p>basically, shared reborrowing from <code>x_inner</code> no longer reactivates <code>x_inner</code>, so <code>x_evil</code> is still usable</p>



<a name="136712551"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked%20borrows%20violation%20in%20slice%20iterators/near/136712551" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked.20borrows.20violation.20in.20slice.20iterators.html#136712551">(Oct 29 2018 at 15:18)</a>:</h4>
<p>reasoning being basically that "shared reborrow" doesnt mean nobody else has stuff. any actual use of <code>x_inner</code> would still invalidate <code>x_evil</code>, of course.</p>



<a name="136716558"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked%20borrows%20violation%20in%20slice%20iterators/near/136716558" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked.20borrows.20violation.20in.20slice.20iterators.html#136716558">(Oct 29 2018 at 16:12)</a>:</h4>
<p>but this has other conseqeuences... we now allow this:</p>
<div class="codehilite"><pre><span></span><span class="c1">// A callee may not read the destination of our `&amp;mut` without</span>
<span class="c1">// us noticing.</span>

<span class="k">fn</span> <span class="nf">main</span><span class="p">()</span><span class="w"> </span><span class="p">{</span><span class="w"></span>
<span class="w">    </span><span class="kd">let</span><span class="w"> </span><span class="k">mut</span><span class="w"> </span><span class="n">x</span><span class="w"> </span><span class="o">=</span><span class="w"> </span><span class="mi">15</span><span class="p">;</span><span class="w"></span>
<span class="w">    </span><span class="kd">let</span><span class="w"> </span><span class="n">xraw</span><span class="w"> </span><span class="o">=</span><span class="w"> </span><span class="o">&amp;</span><span class="k">mut</span><span class="w"> </span><span class="n">x</span><span class="w"> </span><span class="k">as</span><span class="w"> </span><span class="o">*</span><span class="k">mut</span><span class="w"> </span><span class="n">_</span><span class="p">;</span><span class="w"></span>
<span class="w">    </span><span class="kd">let</span><span class="w"> </span><span class="n">xref</span><span class="w"> </span><span class="o">=</span><span class="w"> </span><span class="k">unsafe</span><span class="w"> </span><span class="p">{</span><span class="w"> </span><span class="o">&amp;</span><span class="k">mut</span><span class="w"> </span><span class="o">*</span><span class="n">xraw</span><span class="w"> </span><span class="p">};</span><span class="w"> </span><span class="c1">// derived from raw, so using raw is still okay...</span>
<span class="w">    </span><span class="n">callee</span><span class="p">(</span><span class="n">xraw</span><span class="p">);</span><span class="w"></span>
<span class="w">    </span><span class="kd">let</span><span class="w"> </span><span class="n">_val</span><span class="w"> </span><span class="o">=</span><span class="w"> </span><span class="o">*</span><span class="n">xref</span><span class="p">;</span><span class="w"> </span><span class="c1">// ...but any use of raw will invalidate our ref.</span>
<span class="p">}</span><span class="w"></span>

<span class="k">fn</span> <span class="nf">callee</span><span class="p">(</span><span class="n">xraw</span>: <span class="o">*</span><span class="k">mut</span><span class="w"> </span><span class="kt">i32</span><span class="p">)</span><span class="w"> </span><span class="p">{</span><span class="w"></span>
<span class="w">    </span><span class="c1">// We are a bit sneaky: We first create a shared ref, exploiting the reborrowing rules,</span>
<span class="w">    </span><span class="c1">// and then we read through that.</span>
<span class="w">    </span><span class="kd">let</span><span class="w"> </span><span class="n">shr</span><span class="w"> </span><span class="o">=</span><span class="w"> </span><span class="k">unsafe</span><span class="w"> </span><span class="p">{</span><span class="w"> </span><span class="o">&amp;*</span><span class="n">xraw</span><span class="w"> </span><span class="p">};</span><span class="w"></span>
<span class="w">    </span><span class="kd">let</span><span class="w"> </span><span class="n">_val</span><span class="w"> </span><span class="o">=</span><span class="w"> </span><span class="o">*</span><span class="n">shr</span><span class="p">;</span><span class="w"></span>
<span class="p">}</span><span class="w"></span>
</pre></div>



<a name="136716598"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked%20borrows%20violation%20in%20slice%20iterators/near/136716598" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked.20borrows.20violation.20in.20slice.20iterators.html#136716598">(Oct 29 2018 at 16:13)</a>:</h4>
<p>which is a problem because it means that <code>&amp;mut</code> actually doesnt mean nobody else can access this memory; it only means nobody else can write to this memory. reads would be allowed.</p>



<a name="136717617"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked%20borrows%20violation%20in%20slice%20iterators/near/136717617" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked.20borrows.20violation.20in.20slice.20iterators.html#136717617">(Oct 29 2018 at 16:27)</a>:</h4>
<p><span class="user-mention" data-user-id="116009">@nikomatsakis</span> so we pretty much have to either make <code>iter_mut</code> UB, or we cannot rule out reads from locations we have <code>&amp;mut</code> to</p>



<a name="136719279"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked%20borrows%20violation%20in%20slice%20iterators/near/136719279" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> nikomatsakis <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked.20borrows.20violation.20in.20slice.20iterators.html#136719279">(Oct 29 2018 at 16:52)</a>:</h4>
<p>I'll have to re-read this about 22 times probably <em>but</em> <span class="user-mention" data-user-id="120791">@RalfJ</span> something I am wondering about is:</p>
<p>In your original example, the call to <code>self.len()</code> "just" accesses the <code>len</code> field (ultimately). </p>
<p>I guess part of the problem is that the fns are not inlined?</p>



<a name="136719311"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked%20borrows%20violation%20in%20slice%20iterators/near/136719311" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> nikomatsakis <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked.20borrows.20violation.20in.20slice.20iterators.html#136719311">(Oct 29 2018 at 16:53)</a>:</h4>
<p>This is of course a somewhat common course of "spurious" borrow-check errors too -- that is, having some <code>&amp;self</code> or<code> &amp;mut self</code> method that only accesses one or two fields -- but you can't call it because you have outstanding borrows of some <em>other</em> fields.</p>



<a name="136724217"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked%20borrows%20violation%20in%20slice%20iterators/near/136724217" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Nicole Mazzuca <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked.20borrows.20violation.20in.20slice.20iterators.html#136724217">(Oct 29 2018 at 18:08)</a>:</h4>
<p>I want to make <code>iter_mut</code> UB, to be honest. They should be storing <code>len</code> in the same place they store <code>ptr</code></p>



<a name="136724276"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked%20borrows%20violation%20in%20slice%20iterators/near/136724276" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Nicole Mazzuca <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked.20borrows.20violation.20in.20slice.20iterators.html#136724276">(Oct 29 2018 at 18:09)</a>:</h4>
<p>I feel like allowing this will have unintended consequences with interior mutability, although I can't think of anything right now.</p>



<a name="136724658"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked%20borrows%20violation%20in%20slice%20iterators/near/136724658" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Jake Goulding <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked.20borrows.20violation.20in.20slice.20iterators.html#136724658">(Oct 29 2018 at 18:14)</a>:</h4>
<blockquote>
<p>make <code>iter_mut</code> UB</p>
</blockquote>
<p>I assume this means the current <em>implementation</em> of it, not... the entire concept, right?</p>



<a name="136726164"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked%20borrows%20violation%20in%20slice%20iterators/near/136726164" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Nicole Mazzuca <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked.20borrows.20violation.20in.20slice.20iterators.html#136726164">(Oct 29 2018 at 18:38)</a>:</h4>
<p>yes lol :P</p>



<a name="136726459"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked%20borrows%20violation%20in%20slice%20iterators/near/136726459" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked.20borrows.20violation.20in.20slice.20iterators.html#136726459">(Oct 29 2018 at 18:43)</a>:</h4>
<p><span class="user-mention" data-user-id="116009">@nikomatsakis</span> yes the problem is that a reborrow-to-shr behaves like a read (and then initiating the new ref) -- a principle which sounds so nice I'd like to keep it. :D so this is "using" <code>self</code> (reading from it), which invalidates all borrows derived-from <code>self</code>, including <code>ptr</code>.</p>



<a name="136726525"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked%20borrows%20violation%20in%20slice%20iterators/near/136726525" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked.20borrows.20violation.20in.20slice.20iterators.html#136726525">(Oct 29 2018 at 18:44)</a>:</h4>
<p><span class="user-mention" data-user-id="125253">@Nicole Mazzuca</span> I do not see the connection to interior mutability, but the problem I see is that we have to prevent people from reading locations we have the exclusive access to</p>



<a name="136726573"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked%20borrows%20violation%20in%20slice%20iterators/near/136726573" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked.20borrows.20violation.20in.20slice.20iterators.html#136726573">(Oct 29 2018 at 18:45)</a>:</h4>
<p>and I have not yet found a set of rules that would do that, and allow this code</p>



<a name="136727418"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked%20borrows%20violation%20in%20slice%20iterators/near/136727418" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Nicole Mazzuca <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked.20borrows.20violation.20in.20slice.20iterators.html#136727418">(Oct 29 2018 at 18:58)</a>:</h4>
<p>all it requires is to put the call to <code>len</code> in the right place</p>



<a name="136727420"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked%20borrows%20violation%20in%20slice%20iterators/near/136727420" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Nicole Mazzuca <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked.20borrows.20violation.20in.20slice.20iterators.html#136727420">(Oct 29 2018 at 18:58)</a>:</h4>
<p><span class="user-mention" data-user-id="120791">@RalfJ</span> right, interior mutability allows mutating through a read-only pointer, tho. Assume it's an <code>&amp;mut [Cell&lt;T&gt;]</code> - then <code>.len()</code> is also allowed to mutate the actual elements as well</p>



<a name="136727433"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked%20borrows%20violation%20in%20slice%20iterators/near/136727433" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked.20borrows.20violation.20in.20slice.20iterators.html#136727433">(Oct 29 2018 at 18:58)</a>:</h4>
<p>hm... we could say that it is okay to read through a mut ptr (without activating it) if "on top of it" in the stack, all we have is raw and frz entries.</p>



<a name="136727457"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked%20borrows%20violation%20in%20slice%20iterators/near/136727457" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked.20borrows.20violation.20in.20slice.20iterators.html#136727457">(Oct 29 2018 at 18:58)</a>:</h4>
<p><span class="user-mention" data-user-id="125253">@Nicole Mazzuca</span> sure, but with interior mutability we do much less precise tracking anyway</p>



<a name="136727569"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked%20borrows%20violation%20in%20slice%20iterators/near/136727569" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Nicole Mazzuca <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked.20borrows.20violation.20in.20slice.20iterators.html#136727569">(Oct 29 2018 at 19:00)</a>:</h4>
<p><span class="user-mention" data-user-id="120791">@RalfJ</span> now, sure. in the future, I'd like to have much more tracking, especially with <code>&amp;mut</code> pointers</p>



<a name="136727574"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked%20borrows%20violation%20in%20slice%20iterators/near/136727574" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked.20borrows.20violation.20in.20slice.20iterators.html#136727574">(Oct 29 2018 at 19:00)</a>:</h4>
<p>but hm I think I see what you mean... if we allow this ref to be created even though there is a raw above it, then later when someone writes all we see is a raw at the top, and it is okay to write to an unfrozen raw</p>



<a name="136727585"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked%20borrows%20violation%20in%20slice%20iterators/near/136727585" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked.20borrows.20violation.20in.20slice.20iterators.html#136727585">(Oct 29 2018 at 19:00)</a>:</h4>
<p>oh <code>&amp;mut</code> doesnt care about interior mutability. only <code>&amp;</code> does.</p>



<a name="136727645"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked%20borrows%20violation%20in%20slice%20iterators/near/136727645" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked.20borrows.20violation.20in.20slice.20iterators.html#136727645">(Oct 29 2018 at 19:01)</a>:</h4>
<p>the question, I guess, is if that is a problem</p>



<a name="136727664"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked%20borrows%20violation%20in%20slice%20iterators/near/136727664" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Nicole Mazzuca <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked.20borrows.20violation.20in.20slice.20iterators.html#136727664">(Oct 29 2018 at 19:01)</a>:</h4>
<p>right, but if you allow going from <code>&amp;mut</code> -&gt; <code>&amp;</code> while stacking borrows...</p>



<a name="136727744"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked%20borrows%20violation%20in%20slice%20iterators/near/136727744" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> nikomatsakis <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked.20borrows.20violation.20in.20slice.20iterators.html#136727744">(Oct 29 2018 at 19:03)</a>:</h4>
<p><span class="user-mention" data-user-id="120791">@RalfJ</span> very interesting. Particularly since I would very much like to lift this limitation of the borrow checker at some point (so that you can have some way to declare — or maybe infer? — what fields a given reference can be used to access). In any case, it sort of "makes sense" that this code would be illegal when you look at it from that angle (since the borrow checker would reject), but it may be a common pattern in practice.</p>



<a name="136727746"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked%20borrows%20violation%20in%20slice%20iterators/near/136727746" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked.20borrows.20violation.20in.20slice.20iterators.html#136727746">(Oct 29 2018 at 19:03)</a>:</h4>
<p>why would <code>len</code> writing be a problem? <code>self</code> would "know" about it because the ref used to write is derived-from <code>self</code>, and <code>ptr</code> is raw so it cannot care about others writing.</p>



<a name="136727849"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked%20borrows%20violation%20in%20slice%20iterators/near/136727849" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Nicole Mazzuca <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked.20borrows.20violation.20in.20slice.20iterators.html#136727849">(Oct 29 2018 at 19:04)</a>:</h4>
<p><span class="user-mention" data-user-id="120791">@RalfJ</span> I'm not saying it is an issue, I'm just saying I'd be worried about it being an issue.</p>



<a name="136729254"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked%20borrows%20violation%20in%20slice%20iterators/near/136729254" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked.20borrows.20violation.20in.20slice.20iterators.html#136729254">(Oct 29 2018 at 19:29)</a>:</h4>
<p>ah, none of what I thought of will work</p>



<a name="136729259"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked%20borrows%20violation%20in%20slice%20iterators/near/136729259" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked.20borrows.20violation.20in.20slice.20iterators.html#136729259">(Oct 29 2018 at 19:29)</a>:</h4>
<p>because there are some more reborrows</p>



<a name="136729351"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked%20borrows%20violation%20in%20slice%20iterators/near/136729351" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked.20borrows.20violation.20in.20slice.20iterators.html#136729351">(Oct 29 2018 at 19:31)</a>:</h4>
<p>concretely, calling <code>as_mut_ptr</code> reborrows <code>self</code>, creating some new unique borrows. the <code>Raw</code> then gets derived from them. I cannot think of any reasonable way in which we allow using <code>self</code> to create a new borrow <em>without</em> invalidating those exclusive reborrows, which would be a fundamental departure from the stack discipline.</p>



<a name="136729694"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked%20borrows%20violation%20in%20slice%20iterators/near/136729694" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked.20borrows.20violation.20in.20slice.20iterators.html#136729694">(Oct 29 2018 at 19:37)</a>:</h4>
<p>in particular, for these <code>Uniq</code> items on the stack that we would be "skipping", there might be someone relying on their ref being, well, unique. So allowing this kind of code is fundamentally incompatible with optimizations based on the assumption "nobody else can even read from my <code>&amp;mut</code>".</p>



<a name="136735776"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked%20borrows%20violation%20in%20slice%20iterators/near/136735776" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> nikomatsakis <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked.20borrows.20violation.20in.20slice.20iterators.html#136735776">(Oct 29 2018 at 21:13)</a>:</h4>
<p>I can see why, yes, very interesting</p>



<a name="136760747"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked%20borrows%20violation%20in%20slice%20iterators/near/136760747" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked.20borrows.20violation.20in.20slice.20iterators.html#136760747">(Oct 30 2018 at 07:54)</a>:</h4>
<p>hm, interestingly though this can happen even in safe code... with the infamous "you can reborrow the same <code>&amp;mut</code> to <code>&amp;</code> many times"...</p>



<a name="136760774"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked%20borrows%20violation%20in%20slice%20iterators/near/136760774" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked.20borrows.20violation.20in.20slice.20iterators.html#136760774">(Oct 30 2018 at 07:54)</a>:</h4>
<p>that, combined with the fact that most uses of an <code>&amp;mut</code> are actually a reborrow, makes it so that there <em>are</em> other <code>Uniq</code> on the stack, I just failed to check for them in my implementation so far</p>



<a name="136760778"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked%20borrows%20violation%20in%20slice%20iterators/near/136760778" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked.20borrows.20violation.20in.20slice.20iterators.html#136760778">(Oct 30 2018 at 07:54)</a>:</h4>
<p>so what I considered the "most permissive approach" doesnt even accept all safe code</p>



<a name="136781142"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked%20borrows%20violation%20in%20slice%20iterators/near/136781142" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked.20borrows.20violation.20in.20slice.20iterators.html#136781142">(Oct 30 2018 at 14:45)</a>:</h4>
<p>okay I understood where my mistake was about accepting all that safe code. <code>iter_mut</code> is still a problem though.</p>



<a name="136781241"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked%20borrows%20violation%20in%20slice%20iterators/near/136781241" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked.20borrows.20violation.20in.20slice.20iterators.html#136781241">(Oct 30 2018 at 14:46)</a>:</h4>
<p>I found something that accepts <code>iter_mut</code>, but it's a rather bad hack: When we do a read, and we have to pop stuff from the stack, instead of popping all of it was just pop the <code>Uniq</code>. I think that maintains the exclusivity guarantee we want. However, it means we do not actually have follow a stack discipline any more.</p>



<a name="136783339"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked%20borrows%20violation%20in%20slice%20iterators/near/136783339" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> nikomatsakis <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked.20borrows.20violation.20in.20slice.20iterators.html#136783339">(Oct 30 2018 at 15:20)</a>:</h4>
<blockquote>
<p>okay I understood where my mistake was about accepting all that safe code. <code>iter_mut</code> is still a problem though.</p>
</blockquote>
<p>so safe code is ok now? :)</p>



<a name="136783419"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked%20borrows%20violation%20in%20slice%20iterators/near/136783419" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked.20borrows.20violation.20in.20slice.20iterators.html#136783419">(Oct 30 2018 at 15:20)</a>:</h4>
<p>the one in the test suite is, anyway ;)</p>



<a name="136783513"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked%20borrows%20violation%20in%20slice%20iterators/near/136783513" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked.20borrows.20violation.20in.20slice.20iterators.html#136783513">(Oct 30 2018 at 15:21)</a>:</h4>
<p>and <code>iter_mut</code> is, well, okay-ish. I don't like the fact that we no longer have a stack.</p>



<a name="146801313"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked%20borrows%20violation%20in%20slice%20iterators/near/146801313" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked.20borrows.20violation.20in.20slice.20iterators.html#146801313">(Nov 05 2018 at 15:06)</a>:</h4>
<p>I re-did a large chunk of the model, though the core stayed the same, fixing "partially interior mutable data" at <a href="https://github.com/RalfJung/miri/tree/new-interior-mut" target="_blank" title="https://github.com/RalfJung/miri/tree/new-interior-mut">https://github.com/RalfJung/miri/tree/new-interior-mut</a>. Interestingly that also fixed slice iterators. I still have to understand how and why.</p>



<a name="147243693"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked%20borrows%20violation%20in%20slice%20iterators/near/147243693" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked.20borrows.20violation.20in.20slice.20iterators.html#147243693">(Nov 07 2018 at 18:11)</a>:</h4>
<p>The thing that makes this possible is the implementation of the following rule, which subsumes a bunch of previous rules for handling the "<code>mut</code> can be shared multiple times" situation: When <em>reading</em>, if you are using a ptr with a <code>Uniq</code> tag, and if that tag <em>is</em> in the stack, then we only have to push until the next shared tag, not until the <code>Uniq</code> tag.</p>



<a name="147243711"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked%20borrows%20violation%20in%20slice%20iterators/near/147243711" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked.20borrows.20violation.20in.20slice.20iterators.html#147243711">(Nov 07 2018 at 18:11)</a>:</h4>
<p>In this case, this means that after leaking the <code>&amp;mut</code> to raw, if we then create a shared reference from the <code>&amp;mut</code>, that just reactivates the raw (which is already active). So the code is legal.</p>



<a name="147244130"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked%20borrows%20violation%20in%20slice%20iterators/near/147244130" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked.20borrows.20violation.20in.20slice.20iterators.html#147244130">(Nov 07 2018 at 18:18)</a>:</h4>
<p>The reason this is okay is that popping the stack on reactivate is for the benefit of arguing that <code>Uniq</code> is unique: If any other reference was used or created, that would pop us off the stack first. But this is not in conflict with this new special rule, because that rule only helps if there <em>already</em> are <code>Shr</code> tags on top of the <code>Uniq</code> in the stack.</p>



<a name="147244866"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked%20borrows%20violation%20in%20slice%20iterators/near/147244866" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/stacked.20borrows.20violation.20in.20slice.20iterators.html#147244866">(Nov 07 2018 at 18:29)</a>:</h4>
<p>previously this was somewhat more asymmetric; if the location was <em>frozen</em> we would have an exception like that but if it just was shared for other reasons, we would not</p>



<hr><p>Last updated: Aug 07 2021 at 22:04 UTC</p>
</html>